ERROR in LOGS IdPv3

[John Morrison]

On Wed, 2016-08-24 at 14:54 +0000, Cantor, Scott wrote:
> On 8/24/16, 10:36 AM, "users on behalf of John Morrison" <users-bounces at shibboleth.net on behalf of john.morrison at uadm.uu.se> wrote:
> 
> > OK, but what I don't get, I've enabled CAS on our IDP v3 server and
> > every CAS'd login is recored into the shibboleth/shibpid database, this
> > shouldn't be the case by default?
> 
> By default, there are no SAML persistent IDs in the IdP.
> 
> If you configure your attribute resolver to produce peristent IDs via the StoredIdConnector, then any resolver run is going to hit that connector, and the relying party identifier is what it is. In SAML, it's an entityID, with CAS it's a location.
>     
> >    How do I stop this from happening, as you pointed out, using attributes
> >    to derive persistentIDs, I have no Idea if our IdP is doing this or not.
> 
> Well, it self-evidently is, but if you don't know, certainly nobody else should.
> 
> > I don't want CAS'd auths to be recorded in the shibpid at all.
> 
> Then you'd have to do something to conditionalize the use of that connector based on whether it's a CAS request, or you move the persistentID support out of the resolver into the non-deprecated NameID generation layer, which replaces the old connector, and I don't think runs when CAS does.
>  
> >    How did I get into this mess in the first place :)
> 
> You configured two features that have never been used together by anybody else, or at least nobody's noted it. The use of databases for this is mostly a non-US thing, and the CAS support is mostly a US thing, so the overlap isn't common.
> 
> -- Scott
> 



2016-08-24 18:34:50,641 - DEBUG
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:329] -
Attribute Resolver 'ShibbolethAttributeResolver': Resolving data
connector StoredId
2016-08-24 18:34:50,641 - DEBUG
[net.shibboleth.idp.saml.nameid.impl.JDBCPersistentIdStoreEx:555] -
Stored Id Store: Obtaining persistent ID for source ID: johmo542
2016-08-24 18:34:50,642 - DEBUG
[net.shibboleth.idp.saml.nameid.impl.JDBCPersistentIdStoreEx:577] -
Stored Id Store: Getting active and/or last inactive persistent Id entry
2016-08-24 18:34:50,644 - DEBUG
[net.shibboleth.idp.saml.nameid.impl.JDBCPersistentIdStoreEx:581] -
Stored Id Store: Returning existing active persistent ID: SOME HASH I
REMOVED FROM HERE
2016-08-24 18:34:50,653 - DEBUG
[net.shibboleth.idp.saml.nameid.impl.StoredPersistentIdGenerationStrategy:167] - Obtained persistent ID entry: PersistentIdEntry{persistentId:SOME HASH I REMOVED FROM HERE, localEntityId:https://MY_IDP/idp/shibboleth, recipientEntityId:https://SOME_CAS_APP/portal/portal/uusp?uusp.doLogin=true, sourceId:johmo542, principalName:johmo542, peerProvidedId:null, creationTime:2016-08-24 18:34:49.0, deactivationTime:null, }
2016-08-24 18:34:50,654 - DEBUG
[net.shibboleth.idp.attribute.resolver.AbstractDataConnector:139] - Data
Connector 'StoredId': produced the following 1 attributes during
resolution [persistentId]
2016-08-24 18:34:50,654 - DEBUG
[net.shibboleth.idp.attribute.resolver.AbstractDataConnector:143] - Data
Connector 'StoredId': Attribute 'persistentId': Values
'[StringAttributeValue{value=SOME HASH I REMOVED FROM HERE}]'
2016-08-24 18:34:50,655 - DEBUG
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:347] -
Attribute Resolver 'ShibbolethAttributeResolver': Data connector
'StoredId' resolved the following attributes: [persistentId]
2016-08-24 18:34:50,655 - DEBUG
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:388] -
Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving
dependencies for 'eduPersonTargetedID'
2016-08-24 18:34:50,655 - DEBUG
[net.shibboleth.idp.saml.attribute.resolver.impl.SAML2NameIDAttributeDefinition:153] - Attribute Definition 'eduPersonTargetedID': building a SAML2 NameID with value of 'some hash i removed from here'
2016-08-24 18:34:50,656 - DEBUG
[net.shibboleth.idp.saml.attribute.resolver.impl.SAML2NameIDAttributeDefinition:164] - Attribute Definition 'eduPersonTargetedID': Format set to 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
2016-08-24 18:34:50,656 - DEBUG
[net.shibboleth.idp.saml.attribute.resolver.impl.SAML2NameIDAttributeDefinition:172] - Attribute Definition 'eduPersonTargetedID': NameQualifier set to 'https://MY_IDP/idp/shibboleth'
2016-08-24 18:34:50,656 - DEBUG
[net.shibboleth.idp.saml.attribute.resolver.impl.SAML2NameIDAttributeDefinition:182] - Attribute Definition 'eduPersonTargetedID': SPNameQualifier set to 'https://SOME_CAS_APP/portal/portal/uusp?uusp.doLogin=true'
2016-08-24 18:34:50,657 - DEBUG
[net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:247]
- Attribute Definition 'eduPersonTargetedID': produced an attribute with
the following values
[XMLObjectAttributeValue{value=org.opensaml.saml.saml2.core.impl.NameIDImpl at 65e2fa85}]